fix: resolve GitHub release asset API URL for private repo bundle downloads#3136
Open
lselvar wants to merge 1 commit into
Open
fix: resolve GitHub release asset API URL for private repo bundle downloads#3136lselvar wants to merge 1 commit into
lselvar wants to merge 1 commit into
Conversation
…nloads For private/SSO-protected GitHub repos, browser release download URLs (https://github.com/<owner>/<repo>/releases/download/<tag>/<asset>) redirect to an HTML/SSO page instead of delivering the asset, causing bundle manifest downloads to fail. Extends the pattern from github#2855 (presets/workflows) to cover the bundle manifest download path in _download_remote_manifest: - Resolves browser release URLs to GitHub REST API asset URLs via resolve_github_release_asset_api_url before downloading - Direct REST API asset URLs (api.github.com/repos/.../releases/assets/<id>) are passed through directly - Both cases use Accept: application/octet-stream so the API returns the binary payload rather than JSON metadata - The original catalog URL is used to determine artifact format (.zip vs YAML) since the resolved API URL does not carry the file extension Adds two CLI-level contract tests: - bundle info resolves browser release URL via GitHub tags API - bundle info passes direct API asset URL through with octet-stream Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends the existing “private GitHub release asset download URL” fix to the bundle manifest download path, ensuring bundle info / bundle install can successfully download manifests from private/SSO-protected GitHub release assets by resolving browser release URLs to GitHub REST asset URLs and downloading them with Accept: application/octet-stream.
Changes:
- Apply
resolve_github_release_asset_api_url()in_download_remote_manifest()to translate GitHub browser release download URLs into REST asset URLs prior to downloading. - Send
Accept: application/octet-streamwhen downloading via GitHub REST asset URLs to retrieve the binary payload instead of JSON metadata. - Add contract tests validating browser-URL resolution and direct REST asset URL passthrough for
bundle info.
Show a summary per file
| File | Description |
|---|---|
src/specify_cli/commands/bundle/__init__.py |
Resolve GitHub release asset URLs before manifest download; download assets via REST with octet-stream header. |
tests/contract/test_bundle_cli.py |
Add contract coverage for browser release URL resolution and direct REST asset URL behavior for bundle manifest downloads. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 2
Comment on lines
+436
to
+440
| def test_bundle_info_resolves_github_browser_release_url(project: Path): | ||
| """bundle info resolves a private-repo browser release URL via the GitHub API.""" | ||
| browser_url = "https://github.com/org/repo/releases/download/v1.0/bundle.yml" | ||
| api_asset_url = "https://api.github.com/repos/org/repo/releases/assets/99" | ||
|
|
| # path (which extracts bundle.yml); any other payload is treated as YAML. | ||
| # Use the original catalog URL (``url``) to determine the artifact format | ||
| # since the resolved API URL does not carry the file extension. | ||
| if url.lower().endswith(".zip"): |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
https://github.com/<owner>/<repo>/releases/download/<tag>/<asset>) redirect to an HTML/SSO page instead of the asset, causingbundle install/bundle infoto fail when the catalog'sdownload_urlpoints at such a URLresolve_github_release_asset_api_url(already in_github_http.py) in_download_remote_manifestbefore the HTTP downloadFix — one download path is now covered
_download_remote_manifest(catalog-based bundle manifest download):api.github.com/repos/.../releases/assets/<id>) are passed through directly withAccept: application/octet-stream.zipvs YAML) since the resolved API URL does not carry the file extensionImplementation
Uses the existing shared
resolve_github_release_asset_api_url(download_url, open_url_fn, timeout)function from_github_http.py— the same utility used by the extension, preset, and workflow fixes. No new helpers needed.Test plan
UV_NATIVE_TLS=true SSL_CERT_FILE=/opt/homebrew/etc/openssl@3/cert.pem UV_DEFAULT_INDEX=https://pypi.org/simple PYTHONPATH=src uv run --extra test pytest tests/contract/test_bundle_cli.py -vUV_NATIVE_TLS=true SSL_CERT_FILE=/opt/homebrew/etc/openssl@3/cert.pem UV_DEFAULT_INDEX=https://pypi.org/simple PYTHONPATH=src uv run --extra test pytest tests/contract/ tests/unit/ tests/integration/ tests/test_github_http.pyspecify bundle install <id>works when the catalog'sdownload_urlpoints at a GitHub release asset on a private repospecify bundle info <id>works for the same case🤖 Generated with Claude Code